WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 76 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High BackupEase Plugin backupease Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2.2 Fixed in 2.2.3 CVE-2026-97241 Patchstack
7.5 High StifLi Backup Tools Plugin stifli-backup-tools Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2.7 Fixed in 2.2.8 CVE-2026-97240 Patchstack
7.5 High WordPress Backup & Migration Plugin wp-migration-duplicator Broken Access Control No login needed ≤ 1.6.0 Fixed in 1.6.1 CVE-2026-97197 Patchstack
7.2 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Privilege Escalation Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure < 7.111 Fixed in 7.111 CVE-2026-81810 WPScan
7.5 High ZHBackup – Backup, Restore & Migration Plugin zhbackup Information Disclosure Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure No login needed ≤ 2.4.2 Fixed in 2.4.3 CVE-2026-81804 Patchstack
7.1 High JetBackup Plugin backup Privilege Escalation Subscriber+ Privilege Escalation via Restore Admin User Selection 3.1.7.9 – < 3.1.23.5 Fixed in 3.1.23.5 CVE-2026-19453 WPScan
7.5 High Keep Backup Daily Plugin keep-backup-daily Information Disclosure Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process No login needed < 2.1.4 Fixed in 2.1.4 CVE-2026-75133 VulnCheck
8.8 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration SQL Injection Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution ≤ 7.109 CVE-2026-19949 Wordfence
7.2 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Remote Code Execution Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import < 7.108 Fixed in 7.108 CVE-2026-17533 WPScan
7.5 High Total Upkeep Plugin boldgrid-backup Information Disclosure Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret No login needed < 1.17.3 Fixed in 1.17.3 CVE-2026-16253 WPScan
8.2 High Total Upkeep Plugin boldgrid-backup Broken Access Control No login needed ≤ 1.17.2 Fixed in 1.17.3 CVE-2026-66708 Patchstack
7.2 High Backup Migration Plugin backup-backup Remote Code Execution Authenticated (Administrator+) OS Command Injection via 'file' Parameter ≤ 2.1.1 CVE-2026-7693 Wordfence
7.5 High Demi - One Click Demo Import, Backup & Site Migration Plugin Information Disclosure One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory No login needed < 0.0.7 Fixed in 0.0.7 CVE-2026-14333 WPScan
7.5 High Demi Plugin demi-backup-migration Arbitrary File Deletion Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action No login needed ≤ 0.0.7 CVE-2026-14490 Wordfence
8.1 High WP Foodbakery Plugin Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action ≤ 4.9 CVE-2026-15802 Wordfence
7.1 High pCloud WP Backup Plugin pcloud-wp-backup Cross-Site Request Forgery No login needed ≤ 2.0.2 CVE-2026-57757 Patchstack
7.2 High WP Database Backup Plugin wp-database-backup Remote Code Execution Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter ≤ 7.11 CVE-2026-9834 Wordfence
7.5 High Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups Plugin trinity-backup Information Disclosure Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure No login needed ≤ 2.0.9 Fixed in 2.0.10 CVE-2026-54839 Patchstack
7.5 High Backup Migration Plugin backup-backup Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.1 Fixed in 2.1.2 CVE-2026-39480 Patchstack
8.1 High UpdraftPlus: WP Backup & Migration Plugin updraftplus Authentication Bypass Unauthenticated Authentication Bypass via UpdraftCentral udrpc No login needed ≤ 1.26.4 CVE-2026-10795 Wordfence
7.5 High Backup and Staging by WP Time Capsule Plugin wp-time-capsule Authentication Bypass Broken Authentication No login needed ≤ 1.22.25 Fixed in 1.22.26 CVE-2026-42760 Patchstack
8.8 High Backup and Restore Plugin backup-and-restore-for-wp Arbitrary File Deletion WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion 1.0.3 CVE-2021-47979 VulnCheck
8.1 High Database Backup Plugin wp-db-backup Broken Access Control Missing Authorization to Unauthenticated Arbitrary File Read and Deletion No login needed ≤ 2.5.2 CVE-2026-4030 Wordfence
7.5 High Database Backup Plugin wp-db-backup Broken Access Control Missing Authorization to Unauthenticated Database Export No login needed ≤ 2.5.2 CVE-2026-4029 Wordfence
7.5 High Database Backup Plugin wp-db-backup Broken Access Control Missing Authorization to Unauthenticated Database Backup Interception No login needed ≤ 2.5.2 CVE-2026-4031 Wordfence
7.5 High WordPress Plugin Backup Migration Plugin Information Disclosure WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download No login needed 1.2.8 CVE-2023-54346 VulnCheck
8.8 High Worry Proof Backup Plugin worry-proof-backup Path Traversal Authenticated (Subscriber+) Path Traversal via Backup Upload ≤ 0.2.4 CVE-2026-1311 Wordfence
8.8 High FastDup – Fastest WordPress Migration & Duplicator Plugin fastdup Broken Access Control Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download ≤ 2.7.1 CVE-2026-1104 Wordfence
7.1 High Nifty Backups Plugin nifty-backups Cross-Site Scripting No login needed ≤ 1.08 CVE-2025-52763 Patchstack
8.1 High Bei Fen – WordPress Backup Plugin bei-fen Local File Inclusion WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion No login needed ≤ 1.4.2 CVE-2025-9993 Wordfence
7.1 High XM-Backup Plugin xm-backup Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 0.9.1 CVE-2025-48109 Patchstack
7.5 High Simple Backup Plugin Path Traversal Arbitrary File Download via Path Traversal No login needed < 2.7.11 Fixed in 2.7.11 CVE-2015-10134 Wordfence
7.5 High Total Upkeep by BoldGrid Plugin boldgrid-backup Information Disclosure Unauthenticated Backup Download No login needed ≤ 1.14.9 CVE-2020-36848 Wordfence
7.2 High Migration, Backup, Staging – WPvivid Backup & Migration Plugin wpvivid-backuprestore Arbitrary File Upload WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload ≤ 0.9.116 CVE-2025-5961 Wordfence
7.1 High Backup and Staging by WP Time Capsule Plugin wp-time-capsule Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.22.23 Fixed in 1.22.24 CVE-2025-47477 Patchstack
8.2 High EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 5.25.08 Fixed in 5.25.10 CVE-2025-30788 Patchstack
7.1 High EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 5.25.08 Fixed in 5.25.10 CVE-2025-30787 Patchstack
7.2 High Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Plugin boldgrid-backup Remote Code Execution WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection ≤ 1.16.10 CVE-2025-2257 Wordfence
8.8 High EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Request Forgery Cross-Site Request Forgery to Remote Code Execution No login needed 4.11.13 – 5.25.08 CVE-2025-2319 Wordfence
7.1 High WordPress SQL Backup Plugin wordpress-sql-backup Cross-Site Request Forgery No login needed ≤ 3.5.2 CVE-2025-30608 Patchstack
7.2 High Database Backup and check Tables Automated With Scheduler 2024 Plugin database-backup Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion ≤ 2.36 CVE-2024-13910 Wordfence
7.2 High Database Backup and check Tables Automated With Scheduler 2024 Plugin database-backup Information Disclosure Authenticated (Administrator+) Sensitive Information Exposure ≤ 2.35 CVE-2024-13911 Wordfence
7.2 High Migration, Backup, Staging – WPvivid Plugin wpvivid-backuprestore Arbitrary File Upload WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file ≤ 0.9.112 CVE-2024-13869 Wordfence
7.5 High WP Database Backup – Unlimited Database & Files Backup by Backup for WP Plugin wp-database-backup Information Disclosure Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposure No login needed ≤ 7.3 CVE-2024-12330 Wordfence
8.8 High UpdraftPlus: WP Backup & Migration Plugin updraftplus PHP Object Injection Unauthenticated PHP Object Injection No login needed 1.23.8 – 1.24.11 CVE-2024-10957 Wordfence
8.8 High Backup Migration Plugin backup-backup PHP Object Injection Unauthenticated PHP Object Injection via 'recursive_unserialize_replace' No login needed ≤ 1.4.6 CVE-2024-10932 Wordfence
7.1 High WP SuperBackup Plugin indeed-wp-superbackup Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.3 Fixed in 2.4 CVE-2024-56069 Patchstack
7.4 High WP SuperBackup Plugin indeed-wp-superbackup Broken Access Control Multiple Subscriber+ Broken Access Control vulnerabilities ≤ 2.3.3 Fixed in 2.4 CVE-2024-56070 Patchstack
7.5 High WP SuperBackup Plugin indeed-wp-superbackup PHP Object Injection Subscriber+ PHP Object Injection ≤ 2.3.3 Fixed in 2.4 CVE-2024-56068 Patchstack
7.5 High WP SuperBackup Plugin indeed-wp-superbackup Broken Access Control Unauthenticated Backup File Download No login needed ≤ 2.3.3 Fixed in 2.4 CVE-2024-56067 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only